Typical detection rates for the scripts seem to be about 3/56. The samples I have seen download a malicious binary from one of the following locations (there are probably more):digigoweb.in/k3lxerfacine.com.br/z0odldboontur.com/b2hskde